To install the API, follow these steps:
timedatectl set-ntp yes
timedatectl set-timezone %YOUR TIMEZONE%
Install the packages:
apt update && apt upgrade
apt install postgresql
Configure the SELinux policy or deactivate it with the command:
setenforce 0
then bring the file /etc/selinux/config to the form:
# This file controls the state of SELinux on the system.
# SELINUX= can take one of these three values:
# enforcing - SELinux security policy is enforced.
# permissive - SELinux prints warnings instead of enforcing.
# disabled - No SELinux policy is loaded.
SELINUX=disabled
# SELINUXTYPE= can take one of these three values:
# targeted - Targeted processes are protected,
# minimum - Modification of targeted policy. Only selected processes are protected.
# mls - Multi Level Security protection.
SELINUXTYPE=targeted
Install and configure PostgreSQL:
dnf update
dnf install postgresql-devel postgresql-server
postgresql-setup initdb
sed -i "s|host all all 127.0.0.1/32 ident|host all all 127.0.0.1/32 md5|" /var/lib/pgsql/data/pg_hba.conf
sed -i "s|host all all ::1/128 ident|host all all ::1/128 md5|" /var/lib/pgsql/data/pg_hba.conf
systemctl start postgresql
systemctl enable postgresql
Create a database, user and password to connect the API agent:
su - postgres -c "psql -c \"CREATE DATABASE api;\""
su - postgres -c "psql -c \"CREATE ROLE api PASSWORD 'YOUR_PASSWORD';\""
su - postgres -c "psql -c \"ALTER DATABASE api OWNER TO api;\""
su - postgres -c "psql -c \"ALTER ROLE api WITH LOGIN;\""
su - postgres -c "psql api -c \"GRANT ALL ON ALL TABLES IN SCHEMA public TO api;\""
su - postgres -c "psql api -c \"GRANT ALL ON ALL SEQUENCES IN SCHEMA public TO api;\""
su - postgres -c "psql api -c \"GRANT CREATE ON SCHEMA public TO api;\""
If the database is used on a separate server, then you must provide access to it. To do this, make changes to the PostgreSQL configuration file pg_hba.conf, for example:
# IPv4 local connections:
host all all 10.1.1.1/32 md5
10.1.1.1 - The IP address of the server with the API agent installed.
If you use a database name and/or a username other than the standard ones, you must make the corresponding changes in the configuration files of the API (/var/www/mikiri-waf-api/settings.py) and WMC (/var/www/mikiri-waf-wmc/.env).
127.0.0.1:11211;%SERVER IP%:5432.Before installing the module, be sure to check access to the created database by connecting to it with the command: psql -h %SERVER IP% -U api api. When connecting, enter the password of the api user.
apt update && apt upgrade
apt install apt-transport-https gnupg2 curl
echo "deb https://s.mikiri.ai/repo/stable/debian trixie mikiri-waf" > /etc/apt/sources.list.d/mikiri-waf.list
curl -s https://s.mikiri.ai/repo/gpg.key | gpg --no-default-keyring --keyring gnupg-ring:/etc/apt/trusted.gpg.d/trusted.gpg --import
chmod 644 /etc/apt/trusted.gpg.d/trusted.gpg
apt update
apt install mikiri-waf-api
apt update && apt upgrade
apt install apt-transport-https gnupg2 curl
echo "deb [arch=amd64] https://s.mikiri.ai/repo/stable/ubuntu resolute mikiri-waf" > /etc/apt/sources.list.d/mikiri-waf.list
curl -s https://s.mikiri.ai/repo/gpg.key | gpg --no-default-keyring --keyring gnupg-ring:/etc/apt/trusted.gpg.d/trusted.gpg --import
chmod 644 /etc/apt/trusted.gpg.d/trusted.gpg
apt update
apt install mikiri-waf-api
/etc/yum.repos.d/mikiri-waf.repo look like:[MikiriWAF]
name=Mikiri WAF Packages for RHEL
baseurl=https://s.mikiri.ai/repo/stable/rhel/$releasever/$basearch/
gpgkey=https://s.mikiri.ai/repo/gpg.key
enabled=1
gpgcheck=1
dnf install epel-release
dnf update
dnf install mikiri-waf-api
During the installation of the module, the following pip packages are additionally installed:
cryptography fastapi func-timeout gunicorn jsonref netaddr openapi-spec-validator pandas psycopg2-binary pyarrow pymemcache pyopenssl python-decouple python-multipart requests uvicorn validators
Deployment as a Docker container is described in Deploying API Docker container.
/var/www/mikiri-waf-api/settings.py to connect to PostgreSQL.The address of the proxy server (optional).
PROXY = 'http://proxy.example.com:3128'
It is allowed to use authentication parameters when using a proxy server, for example:
PROXY = 'http://%USER%:%PASSWORD%@proxy.example.com:3128'
The storage period for entries for the event log of the agents (Event collector).
EC_STORAGE_PERIOD = 31
If the value is 31 (the default value), the records will be stored for 31 days, then automatically deleted from the database. If the value is 0, event collection will be deactivated.
The period of storing backups of Mikiri WAF agent settings: Filter settings (web server settings, Filter parameters, signature exclusion rules, request and response processing rules, list of blocked IP addresses), MLC settings, behavioral models, specifications for the API Firewall (including specifications that are automatically generated using MLC).
RB_STORAGE_PERIOD = 31
If the value is 31 (the default value), backups will be stored for 31 days, then automatically deleted from the database. If the value is 0, no backups are created.
The period for storing request statistics in days.
RS_STORAGE_PERIOD = 31
If the value is 31 (the default value), statistics will be stored for 31 days, then automatically deleted from the database. When the value is 0, statistics are not saved.
The period for storing traffic statistics in days.
TS_STORAGE_PERIOD = 31
If the value is 31 (the default value), statistics will be stored for 31 days, then automatically deleted from the database. When the value is 0, statistics are not saved.
Parameters for connecting to the database of the API agent.
DB_HOST = '127.0.0.1'
DB_PORT = '5432'
DB_NAME = 'api'
DB_USER = 'api'
DB_PASS = 'YOUR_PASWORD'
The mode of interaction with the database is in the "read-only" mode. When the option is activated, requests that change data are rejected with the response code 502.
This option is activated on one of the servers with the API module installed to increase fault tolerance in cases where another server with the API module is unavailable.
Activation of the parameter requires configured PostgreSQL replication.
Default value:
RO_MODE = false
Parameters for connecting to the Memcached server.
MEMCACHED_HOST = '127.0.0.1'
MEMCACHED_PORT = '11211'
The number of parallel processes running.
WORKERS = 4
/etc/nginx/conf.d/mikiri-waf-api.conf to the following form:server {
...
# MLS
location /mls/ {
client_max_body_size 2G;
proxy_pass http://127.0.0.1:8088;
allow %MLC SERVER IP%;
deny all;
}
# Default API location
location / {
proxy_pass http://127.0.0.1:8088;
}
}
%MLC SERVER IP% - the IP address (IPv4/IPv6/CIDR/Range) of the MLC server.
The MLS section is designed to configure interaction with MLC in distributed mode of operation. For security reasons, allow access only to the trusted IP addresses of the MLC servers.
/bin/bash /var/www/mikiri-waf-api/venv/set_permissions.sh
mv /etc/nginx/conf.d/mikiri-waf-api.conf.disabled /etc/nginx/conf.d/mikiri-waf-api.conf
nginx -t && service nginx reload
systemctl restart nginx memcached mikiri-waf-api mikiri-waf-api-aux
systemctl status nginx memcached mikiri-waf-api mikiri-waf-api-aux
To integrate the API with the Mikiri WAF software, follow these steps:
/etc/nginx/mikiri-waf/filter/global/waf.conf
Bring it to the following form:
waf_api_proxy http://proxy.example.com:3128;
waf_api_url http://api.example.com:8080;
api.example.com:8080 - the address and port of the server on which the API module is installed;
http://proxy.example.com:3128 - the proxy server address for accessing the API.
/etc/mikiri-waf-mlc/mlc.conf
Bring it to the following form:
waf_api_url = http://api.example.com:8080
waf_api_proxy = http://proxy.example.com:3128
/etc/mikiri-waf-scanner/scanner.conf to the following form:waf_api_url = http://api.example.com:8080
waf_api_proxy = http://proxy.example.com:3128
Information about errors in the API is contained in the event logs:
/var/log/mikiri-waf/api/*.log
The calls that configure the agents and the calls that read logs and statistics, are in API methods.